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Definitions 


Online Behavioural Advertising (OBA) 

Online Behavioural Advertising means the collection of data from a particular computer or device 
regarding web viewing behaviours over time and across multiple web domains not under Common 
Control for the purpose of using such data to predict web user preferences or interests to deliver 
online advertising to that particular computer or device based on the preferences or interests 
inferred from such web viewing behaviours. Online Behavioural Advertising does not include the 
activities of Web Site Operators, Ad Delivery or Ad Reporting, or contextual advertising (e.g. 
advertising based on the content of the web page being visited, a consumer’s current visit to a web 
page, or a search query). 


Icon 

An Icon is a visible web based object that contains a hyperlink to the OBA User Choice Site or to the 
Third Party Notice”. An alternate definition is: The ‘Icon’ is a specific interactive symbol, which is 
placed in or around an OBA ad that, together with wording to be developed, has to be used by Third 
Parties to signify their adherence to the OBA Framework. 


The Icon is one of the components of the Ad Marker, as described below. 


Ad Marker 


The Ad Marker is the visual representation of a link presented to users to learn more about the ad 
they are currently viewing. Consistent and proper usage of the Ad Marker will reinforce the 
application of consumer- friendly standards to Online Behavioural Advertising across the Internet. 


The Ad Marker consists of three elements: the Icon, the approved explanatory text (when displayed) 
and a container to isolate the Icon and/or text from the surrounding creative when being presented 
within an ad. 


For a list of approved explanatory text per language, see Appendix A — Ad Marker Text by Language. 


OBA Ads 

For the purposes of this implementation, an OBA Ad is referred to as an online advertisement which 
is delivered to a particular computer or device based on the preferences or interests inferred by 
using data collected from that particular computer or device regarding web viewing behaviours over 
time and across multiple web domains not under Common Control”. 


OBA Collection Ads 

An OBA collection ad is referred to as an online advertisement which collects data from a particular 
computer or device regarding web viewing behaviours over time and across multiple web domains 
not under Common Control for the purpose of using such data to predict web user preferences or 
interests. An ad can be an OBA collection ad regardless if it is an OBA ad or not. 


Third Party 

An entity is a Third Party to the extent that it engages in Online Behavioural Advertising on a web 
site or web sites other than a web site or web sites it or an entity under Common Control owns or 
operates”. 


1 As defined by the Framework 
? As defined by the Framework 
“As defined by the Framework 


User Language 

User Language represents one of the official European Union (EU) or additional European Economic 
Area (EEA) languages in which information can be presented, so that web users can exercise their 
choice with respect to the collection and use of data for OBA purposes and transfer of such data to 
Third Parties for OBA. For the purposes of this implementation, User Language can be determined in 
a number of ways. For more details see Appendix B - Determine User Language. 


OBA User Choice Site 

A consumer focused web site and education portal (www.youronlinechoices.eu), available in all 
official EU and the additional EEA languages, that provides a mechanism for web users to exercise 
their choice with respect to the collection and use of data for Online Behavioural Advertising 
purposes by one or more Third Parties or links to a mechanism permitting user choice over Online 
Behavioural Advertising. A Technical Implementation Guide addressing integration of Third Parties 
with the OBA User Choice Site will be made available as a separate document. 


This document refers to the Relevant OBA User Choice Site as being the OBA User Choice Site in User 
Language. 


Originating adserver 

When more adservers are involved in the delivery of an ad, the creative and accompanying scripts 
usually reside on only one. This document references the Originating adserver as being the adserver 
that hosts the ad; most times this is the adserver of the Agency or Advertiser, but can be any 
adserver in the delivery chain. 


Introduction 

This document describes how the Ad Marker can be used in Europe across companies involved in 
Online Behavioural Advertising (OBA) to provide enhanced awareness and control to web users and 
to support the on-going self-regulatory programme in the EU/EEA. 


The aim of this document is to drive agreement between industry players such that our 
implementations dovetail correctly at scale. By doing so, the European Industry Self-Regulatory 
Framework on Data Driven Advertising will be supported as efficiently as possible and industry self 
regulation for OBA will therefore be seen as robust and viable. 


This specification version is aimed at this stage towards a static Ad Marker implementation, on all 
ads. However, should industry players want to mark only OBA Ads and OBA Collection Ads, they are 
free to do so, and this specification version also supports this more advanced approach. In such 
cases, it is important and the ad networks obligation to ensure notice is given in cases where data is 
collected for OBA purposes on a website but the ad displayed is not based on a profile. The static Ad 
Marker implementation, on all ads, requires no information to be shared between parties in the ad 
serving process, and hence no decision-making or separate outcomes would arise from different 
scenarios. It is recognised that while this approach does give users relevant control in 
near-real-time, further improvements should be made to increase transparency and control. Future 
implementations will build on this specification version and introduce greater intelligence, e.g. 
detailing all companies that are involved in serving a specific ad. In order to accommodate this and in 
response to the development of OBA and business practices, this document will be regularly 
reviewed and updated as appropriate. 


A central European body European Digital Advertising Alliance (EDAA) is currently being established 
to agree the licence conditions in European markets. Until this is operational, the Icon is available for 
businesses free of charge. (N.B.: a licence fee will be charged for companies using the Icon across EU/ 
EEA). 


Business Case 

Support of the Icon is a central component of the European Industry Self-Regulatory Framework on 
Data Driven Advertising, part of the cross-industry self-regulatory initiative for OBA in Europe. The 
Framework reference is included below (see Appendix F — European Industry Self-Regulatory 
Framework on Data Driven Advertising). 


Compliance with the Framework is essential to any company practising Online Behavioural 
Advertising in the European Union/European Economic Area. 


Timescale 
Pilot solutions, which may or may not be compliant with this specification, have become active 


during Q2 2011. The goal is that this implementation specification be rolled out by the end of Q1 
2012. 


The education campaign is set to start Q2/Q3 2012. 


The ultimate goal is that “by mid 2012 it is foreseen that 70% of all Online Behavioural Advertising 
will carry [sic] the Icon and link to the consumer web tools”. This commitment is 80% for the larger 
EU Markets. 


References 


http://www.easaJ alliance.org/page.aspx/386 


http://www .youronlinechoices.com/goodpractice.html 


Roles and responsibilities 


Who is Involved 


Agency/Advertiser 
adserver 


Demand Side Platform 


Ad Network 


Exchange/ Supply Side 
Platform 


Publisher/ Publisher 
adserver 


Enhanced Notice Provider 


Licensing 


Coordinates and manages advertiser 


spend across media providers. Usually 


is the Originating adserver and hosts 
the ad creative that appears on the 


page 


Optimises value for advertiser over 
multiple ad exchanges or networks 


Optimises value for both Publisher 
and Advertiser 


Optimising value per impression for 
the Publisher 


Hosts the location where the ad will 
appear 


Serves the Ad Marker on behalf of 
other players in the chain 


Serve the overlaid Ad Marker with the 
creative as part of standard practice 


Add the Ad Marker if it is not present 
in the creative. Ensure compliance 
with the relevant obligations in the 
European Industry Self-Regulatory 


Framework 
Ensure when trafficking the campaign 


that the ad includes the Ad Marker. 
Add the Ad Marker if it is not present 
in the creative 


Add the Ad Marker if it is not present 
in the creative. Ensure compliance 
with the relevant obligations in the 
European Industry Self-Regulatory 


Framework 
Publishers have no direct Icon 


responsibility unless they are self- 
managing sales and delivery of OBA 
Ads directly from advertisers, in which 
case they should add the Ad Marker 


Not required, but when present, 
provide an in-ad interstitial with links 
to turn off OBA and more information 


The exact terms of the licence for the Icon are still to be established. It is therefore not known at this 


stage what the fees will be. The serving of the Icon must be done by a company who has a licence, so 


the terms may further define which players in the chain must do so. Companies that advertise in the 


EU/EEA must obtain a licence from the European central body entitled to issue it. 


Liability and Responsibility 


e While it is most practical for the Originating adserver (usually Agency or Advertiser 


adserver)to implement the serving of the Icon, this is distinct from the Agency or 


Advertiser taking responsibility or assuming liability that the Icon will always be served in 


the correct place. 


e Each Third Party is ultimately responsible for ensuring that users are given control in near 


real-time to turn off OBA from its respective domain. 
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e In practice this means that all Third Parties need to ensure that (1) the turn-off 
mechanism is provided on the OBA User Choice Site, and (2) they check themselves that 
the Ad Marker is being served as part of delivery of the ad. If it is missing, then they 
should ensure that it is added, or add it themselves. 

e Inthe event that the Ad Marker is served by multiple players, the recommended solution to 
avoid unsightly clash is for the relevant parties to arrange between themselves who is to 


continue serving the Icon. 


Ad Marker 


The Ad Marker is to be presented in the User Language. The list of the approved texts for the Ad 
Marker can be found in Appendix A — Ad Marker Text by Language. 


This specification refers to two states of the Ad Marker — ‘rolled-in’ and rolled out: 


e Rolled-in: Only the Icon is visible 


e Rolled-out: The Ad Marker text is visible, as well as the Icon 


GROUPON PON Y 


Restaurant Restaurant 
[> Vouchers Vouchers 


AdChoices 
To the Deals > To the Deals > 
Ä ef 7 A | ; | 


OBA Ad Marker Example of Ad Marker in rolled-in Example of Ad Marker in rolled-out 
Icon state state 


This is illustrated below: 


v 


In terms of serving, the Ad Marker will be displayed in the browser window by a script that travels 
along with the ad itself, originating from the Agency Adserver. This script can exist in two versions: 


a) Manual, static version, in which the script or the variables that compose it will not be altered 
by various players along its path; while it has drawbacks, this version is recommended as an 
initial approach for its simplicity and ease of implementation. 

b) Dynamic version, in which the script or the variables that compose it can be altered by 


players along its path. 
In both serving versions above, the script should, at a minimum, fulfil the following functions: 


e determine or store the User Language (as per Appendix B - Determine User Language); 
e store the URL of the interstitial page, should this be different from the OBA User Choice Site; 


ensure correct display of the overlaid Ad Marker and (when present) interstitial page; 
ensure that, in the infrequent situations when the Ad Marker is served by more than one 
party, only the upper-most Ad Marker expands into its rolled-out state when user hovers the 
mouse over the Icon; 

ensure correct delivery of the reporting script, once a reporting/analytics provider was 
selected and (if applicable) the reporting script communicated to interested parties. 


The Ad Marker will exist as three different parts: 


1) 
2) 


3) 


an image for the Icon (being served from one URL); 

23 images (being served from their respective URLs) for the different Ad Marker text 
languages (as specified in Appendix A — Ad Marker Text by Language), one of which will be 
selected and subsequently displayed based on the User Language. The approach based on 
images has been chosen over the one based on text in order to retain formatting and 
dimensions of the Ad Marker over multiple platforms and browsers; 

a container to isolate the Icon and/or text from the surrounding creative when being 


presented within an ad. 


While the content of the images must be identical across the EU/EEA, the adservers may use local 


cached copies of the images to optimise performance. For the purposes of ensuring consistency 


across implementations, a recommended version of the images for the Icon and the language) 


specific Ad Marker text will be hosted in a central location. 


This approach is different to that adopted in the USA because of the need to account for multiple 


languages across Europe, and often more lengthy explanatory text. 


A Note on the Footer (Publishers Only) 


The Footer applies only to Publishers. Having a footer is not an obligation in the Framework but is an 


option to Publishers where relevant and appropriate. We suggest this as good practice. This is a 


Web Site Operator notice (referenced in the European Industry Self-Regulatory Framework on Data 


Driven Advertising as “adequate disclosure”) at the bottom of all pages to provide their visitors with 


a clear and consistent way of finding out more information about the site’s activity. A user clicking 


on the Footer link may be presented with the following information: 


List of Third Parties used by the site with which the user may interact’; 
Links to further information related to OBA and online privacy, particularly the OBA User 


Choice Site; 
Any other information which supports user understanding and the aims of the European 
Industry Self-Regulatory Framework on Data Driven Advertising. 


‘In fact, this is not required under the Framework, but publishers may want to consider this in meeting the 
requirements of the revised e-Privacy Directive. 


The Footer link text itself is not prescribed, but it should be clear. Some examples might be (in the 


site’s language): 


About our Ads Privacy Notice Privacy and Cookies Online Behavioural Advertising 


User Interaction Flow 


The overall user experience flow is as follows: 


1) 


2) 


3) 
4) 


5) 
6) 
7) 


As the ad shows on the screen, it includes an overlay with the Ad Marker. The text of the Ad 
Marker for each individual language is defined in Appendix A — Ad Marker Text by Language. 
The text of the Ad Marker is to be shown in the User Language; for further information on 
the recommended method of determining the User Language see Appendix B J 
Determine User Language; 

The Ad Marker will always be shown in the top right hand corner. As a short] term solution, 
the Ad Marker can be shown on all ads. This specification also allows the Ad Marker to be 
shown only on OBA Ads and OBA Collection Ads. For further details regarding size, colours, 
position, etc. for the Icon and Ad Marker, see the Specification Reference section and 
Appendix D-FAQ; 

The Ad Marker will initially load in a rolled-in state; 

The Ad Marker should roll out to the full state if the user hovers the mouse over the Icon. 
The rollJ out is immediate; 


If the ad is expandable, the Ad Marker should only show in an unexpanded state; 


Video -the Ad Marker should not be included on in) stream video ads; 
If when rolled-out the Ad Marker takes up more than 10% of the overall surface of the 


creative, then it can be presented as just the Icon (its rolled-out state can be 
disabled). Also, the width of the rolled- 

out Ad Marker should never be larger than the width of the ad. Ifthe 

user clicks on the Ad Marker, a new tab/window (depending on browser version) will be 
launched; by default, the URL to open is the relevant OBA User Choice Site, as indicated in 
Appendix A - Ad Marker Text by Language. If a particular player’s interstitial page needs to 
be displayed to the user, this can be achieved by: a) static script — altering the script at its 
origin (in most of the cases at the Agency AdServer) or b) dynamic script -altering the 
relevant variable (specified in the full specification for the dynamic script); 


8) The next step depends on whether an interstitial is present: 


a. Interstitial: In order to improve users’ experience, use of an interstitial page is 
strongly recommended. The Third Party’s interstitial page must include all the 
information required under point A.1. of the European Industry Self-Regulatory 
Framework on Data Driven Advertising. In addition, the Third Party’s interstitial page 
must display in the User Language and link directly to the relevant OBA User Choice 
Site (for example 
http://www.youronlinechoices.com/uk). 

b. No Interstitial: Based on the User Language, the relevant OBA User Choice Site is 


loaded, 
The default non-interstitial flow is illustrated in the diagrams below. 


User Flow — No Interstitial Page 


User visits website. Ad location ultimately calls 
the Agency Ad Server, which hosts the creative. 


Agency Ad Server determines User Language. Agency 
AdServer serves the ad, including appropriate script to 
display the Ad Marker as overlay. 


User clicks the Ad Marker. Links to the 
relevant OBA User Choice site. 


Al 


User visits website. Ad location ultimately calls the 
Agency Ad Server which hosts the creative. 


Agency Ad Server determines User Language. 
Agency Ad Server serves the ad, including 
appropriate script to display the Ad Marker as overlay. 


User clicks the Ad Marker, links to Third Party's 
interstitial page. 


If user clicks for more information, links to the 
relevant OBA User Choice website. 


10 


Specification Reference 


Ad Marker — general considerations 

1. As per the current specification version, appears on all standard ads; however, should 
industry players want to mark only OBA Ads and OBA Collection Ads, they are free to do so. 
A subsequent specification version is to be released to support marking only OBA Ads and 
OBA Collection Ads. 
Ina behaviourally-targeted or otherwise. Appears rolled-in; 
Rolls out when user hovers mouse over the Icon; 
Does not show on most Rich Media ads. Shows on expandables only in unexpanded state 
Does not show on in-stream video ads; 


Oil ESO 


The Ad Marker is served as image rather than text, for purposes of consistency over various 

platforms and browsers; 

7. Ad Marker text is in one of 23 defined strings (one per language) as specified in Appendix A — 
Ad Marker Text by Language; 

8. Ad Marker is conditional on User Language; 

9. The Ad Marker will most commonly be served by the advertiser/agency adserver, i.e. the 


one hosting the creative ad file itself. 


Ad Marker — elements 
The Ad Marker consists of three elements: the Icon, approved accompanying text, and a container to 
isolate the Icon and/or text from the surrounding creative when being presented within an ad. 


OBA Icon 
This Icon is considered to be the standard graphical implementation. It may not be e 
altered in any way. The Icon cannot be less than 12 pixels by 12 pixels (12x12). 


Recommended size is 13x13 pixels. 


Text 

The approved explanatory text for each User Language can be found in Appendix A — Ad Marker Text 
by Language. The approved font for this text is Arial Regular. The text color can be black or grayscale. 
The minimum font size is 10 pixels. The recommended font size is 11 pixels, with -50 horizontal 


character tracking. T AdChoices [> DS 
8px ` da s 
Container 
The container should be sized so that there are is at least 1 pixel of 
: F Spx Apx 
space around the Icon. Therefore, for a 13x13 pixels Icon and 11 pixels DE = 2..1px 
3px: AdChoices i>: 


explanatory text, the height of the container should be 15 pixels. The Zn 
width will vary according to the length of the explanatory text. Inthe 
Ad Marker’s rolled-in state, the size of the container will be 17x15 pixels. 


The Ad Marker text should be placed at a minimum of 2 pixels to the left ofthe Icon and centered 
vertically. The recommended distance is 4 pixels. 


The container’s lower-left corner should be rounded, with a radius of 8 pixels. 
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Ad Marker — placement 
For improved user experience and consistency of the approach, it is recommended that the Ad 
Marker is placed inside of the ad". 


When inside the ad, the default placement choice for the Ad 
Marker should be the upper right hand corner. However, if this 
placement causes visual or functional interference with the 
underlying creative, then it can be placed in any of the four 
corners of the ad at the discretion of the party serving it. There 
should be no space between the Ad Marker and the ad corner. 


When the Ad Marker is placed outside of the ad, its lower edge 
must be placed 3 pixels from the upper edge of the ad. In this case, the Ad Marker will be displayed 
only in the rolled-out state, and the surrounding container is not displayed. The default position 
should be the upper right hand corner; however, because the Ad Marker may replace existing ad 
markers, such as “Advertisement”, the specific horizontal placement of the Ad Marker can be 
changed by the party serving it. 


Ad Marker — colours 
Consistent colour usage across all media is integral to the increased familiarity of the Ad Marker. It 
should always be presented using the approved and recommended colour formulas listed below. 
The colour of the Icon can be changed from one of the colour formulas below when there is a valid 
reason for doing so. However, due to copyright agreements, any 
colour in the red/pink spectrum cannot be used for the Icon. 
More precisely, using the colour circle below, any colour in the 
+30 to -90 degrees range cannot be used. 


180° 


OBA Icon if 

PANTONE: 632 P" if Bik: 
CMYK: C=74 M=9 Y=15 K=01 dE Mi 
RGB: R=0 G=174 B=205 270° (-90°) 


HEX: OOAECD 
Grayscale: 30-100% 


Text 

CMYK: C=0 M=0 Y=0 K=100 
RGB: R=0 G=0 B=0 

HEX: 000000 

Grayscale: 30-100% 


Container 

CMYK: C=19 M=15 Y=15 K=0 

RGB: R=204 G=204 B=204 

HEX: CCCCCC 

Grayscale: 20 

Opacity: 60—90%; recommended value: 70% 


‘If multiple Third Parties with different placement choices are involved the user experience will be negatively 
impacted if the Ad Marker is displayed both inside and around the ad 
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Marker Applications - unacceptable applications 


Do not outline the Ad Marker 


Do not modify or recreate the Ad Marker 


[> Do not place the Ad Marker on a busy background 


Important info [> Do not modify Ad Marker approved texts in any way 


bb 
bb 


Do not create patterns or backgrounds with the Icon 


Do not combine colors in the Ad Marker. 


Clicking the Ad Marker 

It is strongly recommended that Third Parties use an interstitial page, in which case clicking the Ad 
Marker directs to it. If the interstitial page is not used, the default landing page is the relevant OBA 
User Choice Site. 


Interstitial Page 

While from a technical perspective the interstitial pages are not mandatory, in order to improve user 
experience they are strongly recommended. Also, there might be legal obligations with regard to the 
implementation of the el privacy directive in each country. 


If a Third Party is obliged to or chooses to use an interstitial page, under the European Industry Self- 
Regulatory Framework on Data Driven Advertising, the Third Party has to include the following 
information (irrespective of legal notices): 


e Feature the Icon prominently; 

e Third Party’s identity and contact details; 

e The types of data collected and used for the purpose of providing OBA, including an 
indication or whether any data is “personal data” or “sensitive personal data” as defined by 
the national implementation of Directive 95/46/EC; 

+ The purpose or purposes for which OBA data is processed and the recipients or categories of 
recipient not under Common Control and to whom such data might be disclosed; 

e Clear link to where the user can obtain information on Online Behavioural Advertising 
(relevant OBA User Choice Site); 
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e Clear link to where the user can turn off behavioural advertising (relevant OBA User Choice 
Site)’; 


e The fact that the Company adheres to the European Industry Self-Regulatory Framework 
on Data Driven Advertising Principles; 


e Clear link to the Third Party’s own privacy policy and opt! out page; 


e References to relevant affiliated trade bodies, e.g. EDAA. 


Limitations to This Approach 


e Visibility of Who Served this Ad to the User; in this version of the implementation it will not 


be possible to show which parties were involved in showing the user an advertisement. 


* Referred in the Framework as “an easy to use mechanism for exercising choice with regard to the 
collection and use of the data for OBA purposes and to the transfer of such data to Third Parties for OBA” 
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Appendix A - Ad Marker Text by Language 


code 


AUSTRIA A ES Datenechitinfo http://www.youronlinechoices.com/at/ 
BELGIUM a e Choisir sa pub NT 
o Info reclamekeuze | http://www.youronlinechoices.com/be-ni/ | //www.youronlinechoices.com/be-nl/ 


Ci o al 
Cc ee 
some en eee 
Ci e 
CN ol 


* The list of codes is referenced from http://en.wikipedia.org/wiki/List_of ISO_639-1_codes, 


which is a more digestible form of the original document itself, 
http://www.loc.gov/standards/iso639-2/php/code list.php. The RFC that mandates the use of 
these 2 letter codes for content-language is rfc 1766. 
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code" 
IICA 
a 
A TI 
EPA 
eee 
ne e | (nn en 
CS ECT 
CR 
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Appendix B - Determine User Language 


The goal of determining the User Language as part of the Ad Marker delivery process is to ensure 
appropriate information for the web users, so that they can exercise their choice with respect to the 
collection and use of data for OBA purposes and transfer of such data to Third Parties for OBA. 


It is therefore important that the web users see the explanatory text of the Ad Marker, the Third 
Party interstitial page (if present) and the OBA User Choice site in their local language. 


For the purposes of this implementation the primary method to determine User Language is based 
on the value of browser’s language attribute. This approach should work consistently with all parties 
involved in delivering the Ad Marker, thus avoiding potential situations when the Ad Marker is 
served by two parties in two different languages. 


The value of browser’s language attribute can be dynamically detected via JavaScript during Icon 
delivery’. The expected languages in the EU/EEA are those listed in Appendix A- Ad Marker Text by 
Language. 


If the value of browser’s language attribute cannot be read or has a value outside of the expected 
ones, the Ad Marker should behave as if the language was “en” (other defaults may apply in specific 
markets). Also, for improved user experience, there should be an intuitive language-switching 
mechanism on the landing page (OBA User Choice Site) or on the Third Party interstitial page (if 
present). 


Third Parties delivering the Ad Marker may choose to use alternative methods for determining User 
Language, should they prefer to do so, such as GeolP data, ad language, site language, or manually 
when trafficking the campaign. For consistency and overall user experience, it is important that Third 
Parties choosing to use alternative methods make sure that the script displaying the Ad Marker 
behaves correctly (i.e. if multiple parties serve the Ad Marker, only the upper-most Ad Marker 
expands in the rolled-out state). 


* The browser language may be detected using Javascript by querying the values of navigator.language 
(Firefox, Chrome, Opera) or navigator.userLanguage (Internet Explorer). An actual example of this in practice 
can be seen at http://www.gtalbot.org/DHTMLSection/ListAllAttributesAndMethodsOfObjects.html. 
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Appendix C — Key Contacts 


country (name ne [company [ema Jra 


EU Level lonel OBA Project ionel.naftanaila@edaa.eu| +40723216705 
Naftanaila Manager 


Fr Sn A 
AUSTRIA tale.at 

Patrick Marck | General IAB patrick@iab-belgium.be | +32526 5565 
BELGIUM Manager Belgium 

Vesselin Executive IA info@iabulgaria.bg + 359882916892 
BULGARIA Petkov Secretary Bulgaria 


Katerina Executive SPIR katerina.hrubesova@spi | +420(224)251250 
CZECH Hrubesova Director r.cz 
REPUBLIC 


B 
Head of FDIM as@fdim.dk +452783 46 01 
Sgrensen research and 
analysis 
Tero Pajunen | OBA project IAB Finland | tero@iab.fi +358505851500 
manager 
Hélène General IAB France helene@iabfrance.com |+33148781432 
FRANCE Chartier Manager 
Thomas Manager OVK schauf@bvdw.org +491732596700 
GERMANY Schauf 
B 
B 


Endre IA endre@iab.hu +36203332933 
HUNGARY Somogyi Hungary 


Haris Rougas General IAB Greece | haris@iab.gr +302103318065 
GREECE Manager 

Suzanne Chief IAB Ireland | suzanne@iabirelandgro | +353(862)260403 
IRELAND McElligott Executive up.com 


Fabiano General IAB Italy fabiano.lazzarini@iab.it | +39(02)58438443 
ITALY Lazzarini manager 


Auke van den | Board IA auke@adatus.com +31651144989 
Hout member Netherland see 
S 
Willstedt director 


rortuc | WE EEE 
loana Anescu Executive IAB ioana.anescu@iab- +40722511602 
Veronika Managing IAB pizano@iabslovakia.sk +421(948)112100 
EN WS O AA 


Antonio Managing IAB Spain antonio@iabspain.net +34914027699 
Traugott director gonzalo@iabspain.net 
Gonzalo Marketing & 
Iruzubieta reserach 
director 
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‘country |name [mote company [email In | 
Charlotte Thúr | CEO IAB charlotte.thur@iabsveri | +46705101110 
Sweden ge.se 


Urs Flückiger Vice president | IAB Flueckiger@me.com +41794033553 
SWITZERLAND Switzerland 


Nick Stringer Director of nick@iabuk.net +447957691803 
Regulatory 
Affairs 
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Appendix D — FAQ 


Is the Ad Marker required on all ads? 

This implementation version supports displaying the Ad Marker on all ads. However, if companies 
want to display the Ad Marker only on OBA Ads and OBA Collection Ads, they are free to do so. 
Furthermore, subsequent versions of this document will provide full specification of the ‘meta- 
data’ approach needed for displaying the Ad Marker on OBA Ads and OBA Collection Ads only. 


Initially the Ad Marker will be shown on all ads as it makes the technical realisation more 
straightforward, as well as making it clear to see how much reach and support the Icon is getting. 
Where appropriate, it will be important for the information ‘behind’ the Ad Marker to be clear to 
consumers that not all ads are behaviourally targeted. This will be supported by a EU wide 
consumer education campaign. 


Why should I use a footer on my page? 

It is strongly recommended that publishers implement a footer link. Whilst this is not an 
obligation in the Framework, consumers need to be provided with “enhanced notice’ of data 
collection on a web page . This “enhanced notice? could also be provided by the Ad Marker in or 
around the ad (rather than a footer link). 


Why is the Agency adserver normally doing the serving? 

There are many players in the ad serving value chain, each of which has a claim to serve the Ad 
Marker. There are drawbacks in each case, however the Agency adserver (which hosts the ad 
creative file itself) is the most appropriate solution: 


e There may be multiple networks, Supply Side Platforms, Demand Side Platforms and 
exchanges in the chain, so these entities are not suitable for this approach; 

e There are thousands of publishers and hundreds of creative agencies involved, so 
requiring either of these entities to serve the Ad Marker, or embed it in the creative 
represents insurmountable operational issues; 

e There are few advertiser adservers (DART, Atlas, Mediamind, Mediaplex, Adtech and 
Adform probably themselves constitute 70% of all display ads in EU), and their role at the 
end of the ad serving chain is clear. 


It should be noted that whilst it is most practical for the agency to insert the Ad Marker in most 
cases, the Third Party (generally the Ad Network) remains responsible for ensuring that this is in 
place. 


What happens if the Ad Marker doesn’t get served? 

The ‘third party’ responsible will be deemed to be in breach of the European Industry Self- 
Regulatory Framework on Data Driven Advertising. See the relevant compliance and enforcement 
section of the Framework for further details. 


Why use browser language rather than IP address, or the language ad (or page)? 

There are pros and cons of the various options. The major advantage of navigator.language is that 
it is the same for everyone involved, regardless of redirects, different geotargeting etc. The use of 
browser language also allows universal detection via clientJ side javascript rather than dedicated 
server code. This specification does allow for a vendor to utilise a different mechanism; a valid 
reason to do so might be irrelevance of the browser language for the user, in specific markets (i.e 
most browsers are in English, but users don’t understand English well). 
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The Ad Marker clashes with my ad - do I still have to serve it? 

Yes. The reason for the roll-in/roll-out approach of the Icon is to cause minimal clash. Also, this 
specification allows placing the Ad Marker in any of the four corners of the ad, if it causes visual 
or functional interference with the underlying creative. 


Why is the Ad Marker not supported for rich media and in-stream video? 

Implementation is more complex for rich media, and the target of 70% of display advertising can 
reasonably be achieved focused purely on standard banners. This may be updated in a future 
version of this specification. 


What happens if more than one vendor serves the Ad Marker? 

This is entirely possible. With everyone adopting the same standard, the Ad Marker should 
function perfectly well even when layered more than once. However, US experience suggests 
some clash can occur, and the pragmatic solution is for the downstream company to disable 
serving the Ad Marker for that publisher or advertiser. In this version of the implementation, that 
decision can only be made “offline”, i.e. not in real-time. This also applies to the solutions offered 
by third party Enhanced Notice vendors. 


Why does the Ad Marker text “roll out”? Doesn't that make things more complex? 

This is different from the approach in the US, and has been adopted in order to accommodate the 
different language strings in Europe. Some of these strings are likely to be significantly longer 
than “AdChoices”. 
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Appendix E — Enhanced Notice Providers, “In-Ad Interstitial” 


SAVE UP TO | Kaczor?” 
15% Caribbean, 
ONCRUISES | Mexico, Bahamas, — 


us 


The Icon appears in the top right as per usual. 


See Deals Now! 


E specifiemedia” 


This ad may have been matched to your interests 


based on your browsing activity. 

( Spocifie Media helped Vacalicas to Go select ge ad Clicking the Ad Marker expands an interstitial 
for you. within the ad itself. This in-ad content should 
More information & opt-out options » provide the same information and functionality 
What is interest-based advertising? » as a full interstitial page. 


Specific Media Privacy Policy » 
Powered by Evi los 


See Deals Now! 
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Appendix F - European Industry Self-Regulatory 
Framework on Data Driven Advertising 


Introduction 


The undersigned companies (the “Companies”) have developed 
this European self-regulatory Framework (the “Framework”) for 
Online Behavioural Advertising (“OBA”). The Framework lays 
down a structure for codifying industry good practices and 
establishes certain Principles to increase transparency and choice 
for web users within the EU/EEA which are binding upon the 
Companies and Associations. The associations listed at the end 
of this document (the “Associations”) have been working jointly 
on this Framework and support its promotion across the 
advertising ecosystem. The Principles contained herein are 
intended to apply consumer friendly standards to Online 
Behavioural Advertising and the collection of online data in order 
to facilitate the delivery of advertising based on the preferences 
or interests of web users. It does not seek to regulate the content 
of online advertisements nor does it regulate Ad Delivery (as 
defined below). 


Application of the Framework and the 
Principles 


There are a number of differing laws which may apply to OBA, 
particularly in cases where the data collected or processed relates 
to an identified or identifiable natural personal and thereby 
comprises personal data. The Principles assist and encourage 
Companies to design into their systems and contracts a 
framework for compliance with applicable law as well as 
establishing protections for areas that are un-regulated. Given 
that the applicable law varies from country to country, 
compliance with these Principles does not guarantee compliance 
with any applicable law and is not a substitute for such 
compliance. These Principles provide direct benefits to web 
users, in particular by standardising consumer notices on web 
sites or within advertisements, and by creating simple 
mechanisms for accepting or declining OBA, even though 
personal data is not implicated. Web users may make complaints 
about incidents of suspected non-compliance with the Principles 
against the Companies by following the procedures set out in 
the Principles. 


The Framework applies to OBA focusing on web viewing 
behaviour over time and across multiple web domains not under 
Common Control in order to create interest segments or to 
allocate such viewing behaviour against interest segments for the 
purposes of delivering advertisements to and by that web user's 
interests and preferences. 


The Framework does not apply to web viewing behaviour for a 
particular web site or related web sites under Common Control. 
The Framework applies across the Internet “ecosystem”. The 
Framework has separate provisions for Web Site Operators, Third 
Parties and providers of desktop application software that 
engage in OBA. The Framework recognises that a Company may 
conduct a number of different activities, and therefore the 
Framework recognises that different Principles and types of 
notice and consent may therefore be applicable to each different 
activity. 


Definitions 


Ad Delivery 


Ad Delivery is the delivery of online advertisements or 
advertising-related services using Ad Reporting data. Ad Delivery 
does not include the collection and use of Ad Reporting data 
when such data is used to deliver advertisements to a computer 
or device based on user preferences or interests inferred from 
information collected over time and across sites not under 
Common Control. 


Ad Reporting 


Ad Reporting is the logging of page views on a web site or the 
collection or use of other information about a browser, operating 
system, domain name, date and time of the viewing of the web 
page or advertisement, and related information for purposes 
including, but not limited to: 


e Statistical reporting in connection with the activity on a web 
site(s); 

e Web analytics and analysis; and 

e Logging the number and type of ads served on a particular 
web site(s). 


Control 


Control of an entity means that another entity (1) holds a 
majority of the voting rights in it, or (2) is a member of it and 
has the right to appoint or remove a majority of its board of 
directors, or (3) is a member of it and controls alone, pursuant 
to an agreement with other members, a majority of the voting 
rights in it, or (4) has placed obligations upon or otherwise 
controls the policies or activities of it by way of a legally binding 
contract, or (5) otherwise has the power to exercise a controlling 
influence over the management, policies or activities of it, and 
“Controlled” shall be construed accordingly. 


Common Control 


Entities or web sites under Common Control include ones which 
Control, for example parent companies, are Controlled by, such 
as subsidiaries, or are under common Control, such as group 
companies. They also include entities that are under a written 
agreement to process data for the controlling entity or entities, 
and do such processing only for and on behalf of that entity or 
entities and not for their own purposes or on their own behalf. 


Icon 
An Icon is a visible web based object that contains a hyperlink to 


the OBA User Choice Site or to the Third Party Notice described 
in L.A.1. 


Explicit Consent 


Explicit Consent means an individual's freely given specific and 
informed explicit action in response to a clear and 
comprehensible notice regarding the collection and use of data 
for Online Behavioural Advertising purposes. 


Online Behavioural Advertising (OBA) 


Online Behavioural Advertising means the collection of data from 
a particular computer or device regarding web viewing 
behaviours over time and across multiple web domains not 
under Common Control for the purpose of using such data to 
predict web user preferences or interests to deliver online 
advertising to that particular computer or device based on the 
preferences or interests inferred from such web viewing 
behaviours. Online Behavioural Advertising does not include the 
activities of Web Site Operators, Ad Delivery or Ad Reporting, or 
contextual advertising (e.g. advertising based on the content of 
the web page being visited, a consumer's current visit to a web 
page, or a search query). 


OBA User Choice Site 


A consumer focussed web site and education portal 
(www.youronlinechoices.eu), available in all official EU and the 
additional EEA languages, that provides a mechanism for web 
users to exercise their choice with respect to the collection and 
use of data for Online Behavioural Advertising purposes by one 
or more Third Parties or links to a mechanism permitting user 
choice over Online Behavioural Advertising. 


Third Party 


An entity is a Third Party to the extent that it engages in Online 
Behavioural Advertising on a web site or web sites other than a 
web site or web sites it or a an entity under Common Control 
owns or operates. 


Web Site Operator 


A Web Site Operator is the owner, controller or operator of the 
web site with which the web user interacts. 


The Framework 


Principle I. 


Principle Il. 


Notice 


A. Third Party Notice 


1. Third Party Privacy Notice—Third Parties should give clear 
and comprehensible notice on their web sites describing 
their Online Behavioural Advertising data collection and use 
practices. Such notice should include clear descriptions of 
the following: 


(a) Their identity and contact details; 


(b) The types of data collected and used for the purpose of 
providing OBA, including an indication or whether any data 
is “personal data” or “sensitive personal data” as defined by 
the national implementation of Directive 95/46/EC; 


(c) The purpose or purposes for which OBA data is processed 
and the recipients or categories of recipient not under 
Common Control and to whom such data might be 
disclosed; 


(d) An easy to use mechanism for exercising choice with 
regard to the collection and use of the data for OBA purposes 
and to the transfer of such data to Third Parties for OBA; 


(e) The fact that the Company adheres to these Principles; and 
(f) A link to the OBA User Choice Site. 
2. Third Party Enhanced Notice to Consumers 


(a) In addition to providing notice as described in A.1, Third 
Parties should provide enhanced notice of the collection of 
data for OBA purposes via the Icon in or around the 
advertisement; and 


(b) Third Parties may provide notice via the Icon on the web 
page where the data for OBA purposes is collected if there 
is an arrangement with the Web Site Operator for the 
provision of such notice. 


B. Web Site Operator Notice 


In addition to complying with applicable existing legal 
obligations, when a Web Site Operator permits data to be 
collected from and used on a web site for OBA purposes by Third 
Parties, the Web Site Operator should provide adequate 
disclosure of this arrangement. The Web Site Operator does not 
need to include such disclosure in instances where the Third 
Party provides notice as described in 1.A.2. 


User choice over Online Behavioural Advertising 


A. Each Third Party should make available a mechanism for web 
users to exercise their choice with respect to the collection 
and use of data for OBA purposes and the transfer of such 
data to Third Parties for OBA. 
available from the notice described in LAT and via the OBA 
User Choice Site. 


Such choice should be 


B. To the extent that Companies collect and use data via specific 
technologies or practices that are intended to harvest data 
from all or substantially all URLs traversed by a particular 
computer or device across multiple web domains and use 
such data for OBA, they should first obtain Explicit Consent. 


C. Companies that have obtained Explicit Consent pursuant to 
II.B should provide an easy to use mechanism for web users 
to withdraw their Explicit Consent to the collection and use 
of such data for OBA. 


Principle Ill. 
Data Security 


A. Safeguards 

Companies should maintain appropriate physical, electronic, and 
administrative safeguards to protect the data collected and used 
for Online Behavioural Advertising purposes. 

B. Data Storage 

Companies should retain data that is collected and used for 


Online Behavioural Advertising only for as long as necessary to 
fulfil a legitimate business need, or as required by law. 


Principle IV. 


Sensitive Segmentation 
A. Children's segmentation 


Companies agree not to create segments for OBA purposes that 
are specifically designed to target children. For the purposes of 
this provision, ‘children’ refers to people age 12 and under. 


B. Other Sensitive Segments 


Any Company seeking to create or use such OBA segments 
relying on use of sensitive personal data as defined under Article 
8.1 of Directive 95/46/EC will obtain a web user's Explicit 
Consent, in accordance with applicable law, prior to engaging 
in OBA using that information. 


The Framework 


Principle V. 


Education 


Companies that engage in OBA should provide information to 
inform individuals and businesses about OBA, including easily 
accessible information about how data for OBA purposes is 
obtained, how it is used and how web user choice may be 
exercised. This may include information in easy-to-understand 
language and user-friendly format (such as online video). 
Companies and Associations are encouraged to use a consistent 
or common resource for such educational information. 


Principle VI. 


Compliance and Enforcement Programmes 
A. Applicability and Eligibility 


This Framework is self-regulatory in nature and creates obligations 
for any signatory Company that self-certifies compliance with 
the Principles and obligations contained herein. Following the 
adoption of this Framework and the Icon each Company should 
comply and self certify by 30 June 2012. Companies adopting 
the Framework later than 1 January 2012 should comply and self 
certify within 6 months of adopting the Framework and the Icon. 


B. Compliance and Self-certification 


Self-certification of compliance shall be limited to those 
requirements applicable to each Company's business model. In 
the event that a single Company may be subject to multiple 
obligations, self-certification must cover all such applicable 
provisions. Self-certification of compliance with this Framework 
does not exempt Companies from fulfilling their obligations 
under applicable national laws. 


C. Auditing of Self-certification 


Companies that are subject to Principle Il shall submit to 
independent audits of their self-certification. Audits should be of 
sufficient scope to review compliance of Companies engaging 
in OBA in the EU and EEA Member States. Such independent 
audits must demonstrate, at a minimum, the following attributes: 


a) Processes for individual and independent review of 
Company web sites for the purpose of validating compliance 
with obligations under this Framework; 


b) Processes for automated or individualised periodic 
monitoring of a statistically significant number of web sites 
where objective evidence of compliance with Principles | and 
Il in this Framework can be verified; 


c) Processes for resolving identified areas of non- 


compliance directly with the signatory Company in a 
transparent manner and within a reasonable period of time; 


d) Publication of decisions in case of un-rectified non- 
compliance with any commitments made under this 
Framework, as well as the findings of general good 
compliance, for one or multiple Companies that have self- 
certified under this Framework. 


D. Consumer Complaints Handling 


Programmes under this Framework for complaints handling shall 
include the following elements: 


a) Easily accessible mechanisms for complaints to be filed 
directly to Companies; 


b) Transparent, easily recognisable and accessible 
mechanisms for handling complaints through independent, 
alternative dispute resolution 
advertising self-regulatory bodies; 


mechanisms such as 


c) Coordination between Companies and alternative 
dispute resolution mechanisms, including advertising self- 
regulatory bodies, to ensure that Companies engaged in 
OBA are not unreasonably subject to multiple enforcement 
mechanisms regarding compliance with the obligations of 
the Framework; 


d) Consumers filing complaints to a complaints handling 
body, including advertising self-regulatory organisations 
shall have access to a simple complaint handling 
mechanisms in their local language; 


e) Publication of decisions in case of non-compliance with 
the commitments under this Framework, including in the 
language of the country where the complaint was first 
launched. 


In addition, Companies that are subject to this Principle shall 
collaborate to make available the OBA User Choice Site. 


E. Relationship between Compliance Programmes: 


Administrators of relevant auditing and compliance 
programmes, including existing advertising self-regulatory 
systems in the context of processing consumer complaints, 
should ensure effective coordination, including promoting a 
common audit form within the EU and EEA Member States and 


with other regions or countries such as the USA. 


Administrators of relevant compliance programmes should also 
coordinate to ensure transparency, consistency and coherence 
of the implementation and enforcement across EU and EEA 
Member States. 


The Framework 


Principle VII. 


Review 


The undersigning Companies and Associations shall regularly review this Framework at least every 3 years in response to the 
development of OBA and business practices, and modify or add to the Framework as appropriate. 


